CVE-2024-38228: Microsoft SharePoint Server RCE Flaw

CVE-2024-38228 Overview

CVE-2024-38228 is a remote code execution vulnerability in Microsoft SharePoint Server. The flaw is associated with [CWE-77], improper neutralization of special elements used in a command. An authenticated attacker with elevated privileges can execute arbitrary code on the target SharePoint Server over the network. Successful exploitation compromises confidentiality, integrity, and availability of the affected server.

The vulnerability affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise. Microsoft published guidance and a security update on the MSRC portal.

Critical Impact
Authenticated attackers holding elevated SharePoint permissions can execute arbitrary code on the server, leading to full compromise of hosted content and adjacent identity data.

Affected Products

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server 2019
Microsoft SharePoint Server 2016 (Enterprise)

Discovery Timeline

2024-09-10 - CVE-2024-38228 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38228

Vulnerability Analysis

The vulnerability resides in Microsoft SharePoint Server and is classified as a remote code execution issue. It is tracked under [CWE-77] as an improper command neutralization weakness. An attacker who has authenticated to SharePoint with high privileges can craft input that the server processes without adequate sanitization. The server then executes attacker-controlled commands within the SharePoint application context.

Because SharePoint often runs with access to backend databases, service accounts, and integrated identity providers, code execution on the server extends the blast radius beyond a single web application. Attackers can pivot to file shares, SQL back ends, and connected Microsoft 365 tenants. Microsoft addressed the issue through a security update referenced in the Microsoft Security Update CVE-2024-38228.

Root Cause

The root cause is improper neutralization of special elements in a command string ([CWE-77]). SharePoint accepts input from an authenticated administrative surface and forwards it to a downstream execution context without stripping or escaping command metacharacters. The resulting command is executed by the SharePoint worker process.

Attack Vector

The attack vector is Network. The attacker must first authenticate to SharePoint and hold high privileges, such as a site collection administrator or equivalent role. No user interaction is required once the attacker has that access. The attacker sends a crafted request to the vulnerable SharePoint endpoint, and the server executes the injected command.

No public proof-of-concept code is available for CVE-2024-38228 at the time of writing. See the Microsoft Security Update CVE-2024-38228 for vendor technical guidance.

Detection Methods for CVE-2024-38228

Indicators of Compromise

Unexpected child processes spawned by w3wp.exe under the SharePoint application pool identity, particularly cmd.exe, powershell.exe, or scripting hosts.
New or modified .aspx, .ashx, or .asmx files under SharePoint web application directories such as C:\Program Files\Common Files\microsoft shared\Web Server Extensions\.
Outbound network connections from SharePoint servers to previously unseen external hosts.
Administrative actions in SharePoint audit logs from accounts that do not typically perform them.

Detection Strategies

Alert on IIS worker process (w3wp.exe) spawning command interpreters or LOLBins, which is atypical for SharePoint runtime behavior.
Correlate SharePoint ULS logs with process telemetry to identify administrative operations immediately preceded by anomalous authentication.
Baseline expected SharePoint service account behavior and flag deviations such as file writes outside content databases.

Monitoring Recommendations

Ingest SharePoint ULS logs, IIS logs, and Windows Security event logs into a centralized SIEM for correlation.
Monitor privileged SharePoint role assignments and administrative endpoint access for unusual accounts or source IPs.
Track process creation events (Event ID 4688 or equivalent EDR telemetry) on SharePoint servers for command shells and script hosts.

How to Mitigate CVE-2024-38228

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2024-38228 to all affected SharePoint servers.
Audit SharePoint administrative role membership and remove accounts that do not require elevated permissions.
Rotate credentials for SharePoint service accounts and farm administrators if compromise is suspected.
Review SharePoint audit and IIS logs for anomalous administrative activity prior to patching.

Patch Information

Microsoft released fixes for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 through the September 2024 security update cycle. Refer to the Microsoft Security Update CVE-2024-38228 for KB article identifiers and download links specific to each SharePoint version.

Workarounds

Restrict access to SharePoint administrative endpoints using network segmentation and IP allowlisting until the patch is applied.
Enforce multi-factor authentication for all SharePoint administrative accounts to raise the cost of credential compromise.
Reduce the number of accounts holding site collection administrator or farm administrator roles to the minimum required.

bash

# Example: enumerate SharePoint farm administrators for review
Add-PSSnapin Microsoft.SharePoint.PowerShell
Get-SPFarm | Select-Object -ExpandProperty AdminContentPublishingWebApplication |
  ForEach-Object { $_.SiteCollectionAdministrators }